v1.3.1

PremiumUUID v1.3.1

Security & Fixes

• Unauthorized Pardon (security): Any player, even without op, could type /pardon <player> and the plugin would lift that player's bans on every known identity. Identities are now only pardoned when the sender is allowed to use /pardon, or when the command itself lifted a ban. Updating is recommended for every server.
• IP & Third-Party Bans Respected: The plugin no longer lets in players kicked as banned when the ban did not come from the vanilla profile ban list. IP bans (/ban-ip) and bans from other plugins are now always kept.
• Whitelist Op Bypass: Ops who are not in whitelist.json are no longer kicked by the plugin, matching vanilla behaviour.
• Kick Messages Preserved: Players rejected for another reason, such as a full server, no longer see "You are not whitelisted".
• Login Resilience: Unusual nicknames or a malformed response from the Mojang API could throw errors during login. The player now joins with the offline UUID instead.
• Mojang API Timeouts & Rate Limits: timeout-ms now limits the whole lookup, and the plugin backs off after a rate limit (HTTP 429) or a failed lookup instead of querying Mojang again on every reconnect.
• Reload Feedback: /premiumuuid reload now warns that a change to cache.file only takes effect after a restart.

Compatibility

• Paper 1.21.1 – 26.3, tested in CI on 1.21.1, 1.21.4, 1.21.7, 1.21.11, 26.1.2, 26.2 and 26.3.
• Paper and its forks (e.g. Purpur) only. Spigot, Bukkit and Folia are not supported.

Under the Hood

• Lighter Disk I/O: The UUID cache is only written when it changed, and command-triggered writes no longer block the main thread.
• Thread-Safe Config: Configuration values are swapped atomically on reload, so async logins never read a half-updated config.
• E2E Version Matrix: The Mineflayer E2E suite now runs against seven Paper versions on every commit, including a new test that a non-op /pardon is ignored.
• Extended Test Coverage: Unit tests went from 8 to 33, covering the pardon authorization, ban/whitelist handling, Mojang API client, cache and config reload.
• Docs: Documented that ban, whitelist and pardon handling stays active when premium-uuid-enabled is false, so earlier premium identities cannot be used to evade bans.

v1.3.0

PremiumUUID v1.3.0

New Features

• Reset Command: Added a new /premiumuuid reset <player> command. This allows admins to completely clear a player's individual override, resetting their status back to the global default (unset) instead of having to manually enforce an enable or disable.
• Improved Status Clarity: When checking /premiumuuid status <player>, the plugin now returns Override: unset instead of none for players with no active override, improving UX and clarity.

Under the Hood

• Extended Test Coverage: Added unit testing around the new OverrideStore removal mechanics and command behavior to guarantee stability.
• E2E Reset Validation: The new reset command is fully covered by the E2E suite, ensuring that the fallback state reflects immediately in-game when an override is cleared.

v1.2.0

PremiumUUID v1.2.0

Security & Fixes

• Ban Bypass Protection: Closed a security vulnerability where players could potentially bypass server bans due to conflicting offline/premium UUID resolutions in the cache.
• Pardon Interception: The plugin now actively intercepts the /pardon command to immediately flush the pardoned player's identities from the UUID cache. This ensures the player can reconnect instantly without waiting for the cache TTL to expire.
• Native Permissions: Delegated permission handling natively to Bukkit's plugin.yml. Players without the premium-uuid.admin permission will no longer see the commands in Tab-Complete (1.13+ Brigadier support), seamlessly returning the vanilla "Unknown or incomplete command" error.

Under the Hood

• Mineflayer E2E Test Suite: Implemented a blazing-fast End-to-End test suite running against a live Paper 26.2 Docker container. This guarantees that bans, whitelists, pardons, and overrides function flawlessly in real-world server environments on every commit.
  • Unit Tests: Added comprehensive Unit Tests rigorously covering the PreLoginListener logic, ban interceptions, and override systems.
  • Code Refactor: Deep cleanup of unnecessary comments and optimization of the Cache and Configuration classes for a cleaner, professional-grade codebase.

v1.1.1

PremiumUUID v1.1.1

Changed

• /premiumuuid lookup renamed to /premiumuuid status
• /premiumuuid active renamed to /premiumuuid enable
• /premiumuuid inactive renamed to /premiumuuid disable

Fixed

• Players on the whitelist being kicked when override was enabled (UUID mismatch between offline and premium)
• Same issue in reverse when switching from enable back to disable

v1.1.0

PremiumUUID v1.1.0

New

• /premiumuuid active <player> — forces premium check on for a specific nickname, even if premium-uuid-enabled: false
• /premiumuuid inactive <player> — forces premium check off for a specific nickname, even if premium-uuid-enabled: true
• Overrides persist across restarts in plugins/PremiumUUID/overrides.yml
• /premiumuuid lookup now shows the override status for a player

Fixed

• Per-nickname overrides take precedence over the global toggle

v1.0.0

PremiumUUID v1.0.0

First stable release of PremiumUUID. This plugin resolves Mojang UUIDs for premium accounts connecting to offline-mode servers, maintaining player data continuity (inventories, statistics, and permissions).

Features

• Asynchronous Resolution: Fetches UUIDs during the AsyncPlayerPreLoginEvent without blocking the main server thread.
• Persistent Caching: Implements a thread-safe disk cache (uuid-cache.yml) with configurable TTL to minimize external API calls and avoid rate limits.
• Graceful Fallback: Automatically defaults to stale cache data or standard offline UUIDs if the Mojang API becomes unreachable or times out.
• Administrative Commands: Includes /puuid lookup, /puuid reload, and /puuid clearcache for real-time management.

Security Notice

Important: This plugin does not perform account authentication or verify ownership. It only checks if a nickname exists on the Mojang database. It is intended strictly for private, trusted servers.